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[Device Driver 1: installs wrapper] 

ddl_old = services [ CREATE_PROCESS_INDEX ] ; 
services [ CREATE_PROCESS_INDEX ] = ddl_new; 

[Device Driver 2: installs wrapper] 

dd2_old = services [ CREATE_PROCESS_INDEX ] ; 
services [ CREATE_PROCESS_INDEX ] = dd2_new; 

[Device Driver 1: removes wrapper] 

services [ CREATE_PROCESS_INDEX ] = ddl_old; 

Notice that services[CREATE_PROCESS_INDEX] now contains its original value (that of the real System 
Service). Device Driver 2 has been unwrapped without its knowledge! 
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